CVE-2026-3281 libvips bandrank.c vips_bandrank_build heap-based overflow
A heap-based buffer overflow in libvips allows local attackers to execute arbitrary code or cause denial of service via crafted input.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3281?
CVE-2026-3281 is a medium-severity memory corruption vulnerability in libvips, published on 27 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was detected in libvips 8.19.0. This affects the function vips_bandrank_build of the file libvips/conversion/bandrank.c. Performing a manipulation of the argument index results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is named fd28c5463697712cb0ab116a2c55e4f4d92c4088. It is suggested to install a patch to address this issue.
Which versions are affected by CVE-2026-3281?
It affects 1 product.
Products include Libvips Libvips.
How do I fix CVE-2026-3281?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-3281 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3281 exists.
Other vulnerabilities in libvips
- CVE-2019-17534 Use after free in n/a
- CVE-2026-33327 Possible integer overflow leading to potential heap-based buffer overflow
- CVE-2026-35591 Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile
- CVE-2026-33328 Possible integer overflow on 32-bit systems when reading GIF images
- CVE-2026-35590 Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata
Sources
Also known as DEBIAN-CVE-2026-3281, GHSA-f98h-2fjh-775c, UBUNTU-CVE-2026-3281.